@@ -35,7 +35,7 @@ require (
3535 github.com/google/go-cmp v0.7.0
3636 github.com/google/go-containerregistry v0.20.7
3737 github.com/google/go-github/v63 v63.0.0
38- github.com/google/osv-scalibr v0.3.4
38+ github.com/google/osv-scalibr v0.4.5
3939 github.com/google/uuid v1.6.0
4040 github.com/gorilla/handlers v1.5.2
4141 github.com/gorilla/securecookie v1.1.2
@@ -113,7 +113,7 @@ require (
113113 cyphar.com/go-pathrs v0.2.1 // indirect
114114 deps.dev/api/v3 v3.0.0-20250903005441-604c45d5b44b // indirect
115115 deps.dev/api/v3alpha v0.0.0-20250903005441-604c45d5b44b // indirect
116- deps.dev/util/maven v0.0.0-20250903005441-604c45d5b44b // indirect
116+ deps.dev/util/maven v0.0.0-20251104021112-20ad94767ddf // indirect
117117 deps.dev/util/pypi v0.0.0-20250903005441-604c45d5b44b // indirect
118118 deps.dev/util/resolve v0.0.0-20250903005441-604c45d5b44b // indirect
119119 deps.dev/util/semver v0.0.0-20250903005441-604c45d5b44b // indirect
@@ -130,9 +130,11 @@ require (
130130 github.com/Microsoft/hcsshim v0.14.1 // indirect
131131 github.com/Yiling-J/theine-go v0.6.2 // indirect
132132 github.com/a8m/envsubst v1.4.3 // indirect
133+ github.com/aead/serpent v0.0.0-20160714141033-fba169763ea6 // indirect
133134 github.com/agext/levenshtein v1.2.3 // indirect
134135 github.com/alecthomas/chroma/v2 v2.18.0 // indirect
135136 github.com/alecthomas/participle/v2 v2.1.4 // indirect
137+ github.com/anchore/go-lzo v0.1.0 // indirect
136138 github.com/anchore/go-struct-converter v0.1.0 // indirect
137139 github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op // indirect
138140 github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
@@ -154,6 +156,7 @@ require (
154156 github.com/aws/smithy-go v1.24.2 // indirect
155157 github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
156158 github.com/aymerick/douceur v0.2.0 // indirect
159+ github.com/bazelbuild/buildtools v0.0.0-20250826111327-4006b543a694 // indirect
157160 github.com/buger/jsonparser v1.1.2 // indirect
158161 github.com/cenkalti/backoff/v5 v5.0.3 // indirect
159162 github.com/charmbracelet/colorprofile v0.4.1 // indirect
@@ -163,6 +166,7 @@ require (
163166 github.com/charmbracelet/x/term v0.2.2 // indirect
164167 github.com/clipperhouse/displaywidth v0.10.0 // indirect
165168 github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
169+ github.com/compose-spec/compose-go/v2 v2.8.1 // indirect
166170 github.com/containerd/cgroups/v3 v3.1.2 // indirect
167171 github.com/containerd/containerd v1.7.29 // indirect
168172 github.com/containerd/containerd/api v1.10.0 // indirect
@@ -180,14 +184,19 @@ require (
180184 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
181185 github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb // indirect
182186 github.com/dimchansky/utfbom v1.1.1 // indirect
187+ github.com/diskfs/go-diskfs v1.7.0 // indirect
183188 github.com/distribution/reference v0.6.0 // indirect
189+ github.com/djherbis/times v1.6.0 // indirect
184190 github.com/dlclark/regexp2 v1.11.5 // indirect
185191 github.com/docker/go-connections v0.6.0 // indirect
186192 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
187193 github.com/docker/go-units v0.5.0 // indirect
194+ github.com/dsoprea/go-exfat v0.0.0-20190906070738-5e932fbdb589 // indirect
195+ github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
188196 github.com/dustin/go-humanize v1.0.1 // indirect
189197 github.com/edsrzf/mmap-go v1.1.0 // indirect
190198 github.com/elliotchance/orderedmap v1.8.0 // indirect
199+ github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab // indirect
191200 github.com/emicklei/go-restful/v3 v3.13.0 // indirect
192201 github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
193202 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
@@ -196,6 +205,7 @@ require (
196205 github.com/felixge/httpsnoop v1.0.4 // indirect
197206 github.com/fxamacker/cbor/v2 v2.9.0 // indirect
198207 github.com/go-chi/chi/v5 v5.2.5 // indirect
208+ github.com/go-errors/errors v1.0.2 // indirect
199209 github.com/go-jose/go-jose/v4 v4.1.4 // indirect
200210 github.com/go-ole/go-ole v1.2.6 // indirect
201211 github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
@@ -209,6 +219,7 @@ require (
209219 github.com/go-openapi/swag/stringutils v0.25.5 // indirect
210220 github.com/go-openapi/swag/typeutils v0.25.5 // indirect
211221 github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
222+ github.com/go-restruct/restruct v1.2.0-alpha // indirect
212223 github.com/go-sql-driver/mysql v1.9.3 // indirect
213224 github.com/goccy/go-yaml v1.18.0 // indirect
214225 github.com/gogo/protobuf v1.3.2 // indirect
@@ -219,6 +230,8 @@ require (
219230 github.com/gorilla/css v1.0.1 // indirect
220231 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
221232 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
233+ github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f // indirect
234+ github.com/icholy/digest v1.1.0 // indirect
222235 github.com/in-toto/attestation v1.1.2 // indirect
223236 github.com/jackc/pgpassfile v1.0.0 // indirect
224237 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -239,7 +252,10 @@ require (
239252 github.com/lestrrat-go/jwx/v3 v3.1.0 // indirect
240253 github.com/lestrrat-go/option v1.0.1 // indirect
241254 github.com/lestrrat-go/option/v2 v2.0.0 // indirect
255+ github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40 // indirect
256+ github.com/masahiro331/go-ext4-filesystem v0.0.0-20240620024024-ca14e6327bbd // indirect
242257 github.com/mattn/go-localereader v0.0.1 // indirect
258+ github.com/mattn/go-shellwords v1.0.12 // indirect
243259 github.com/mfridman/interpolate v0.0.2 // indirect
244260 github.com/micromdm/plist v0.2.1 // indirect
245261 github.com/miekg/dns v1.1.61 // indirect
@@ -273,8 +289,10 @@ require (
273289 github.com/opencontainers/selinux v1.13.1 // indirect
274290 github.com/openfga/api/proto v0.0.0-20260319214821-f153694bfc20 // indirect
275291 github.com/openfga/language/pkg/go v0.2.1 // indirect
276- github.com/ossf/osv-schema/bindings/go v0.0.0-20250805051309-c463400aa925 // indirect
292+ github.com/ossf/osv-schema/bindings/go v0.0.0-20260129002236-09a17f85b44a // indirect
277293 github.com/package-url/packageurl-go v0.1.3 // indirect
294+ github.com/pierrec/lz4/v4 v4.1.25 // indirect
295+ github.com/pkg/xattr v0.4.10 // indirect
278296 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
279297 github.com/pressly/goose/v3 v3.27.0 // indirect
280298 github.com/prometheus/otlptranslator v1.0.0 // indirect
@@ -310,9 +328,11 @@ require (
310328 github.com/tklauser/numcpus v0.10.0 // indirect
311329 github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
312330 github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c // indirect
331+ github.com/ulikunitz/xz v0.5.14 // indirect
313332 github.com/valyala/fastjson v1.6.10 // indirect
314333 github.com/vektah/gqlparser/v2 v2.5.32 // indirect
315334 github.com/x448/float16 v0.8.4 // indirect
335+ github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
316336 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
317337 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
318338 github.com/yuin/goldmark-emoji v1.0.6 // indirect
@@ -346,11 +366,12 @@ require (
346366 modernc.org/mathutil v1.7.1 // indirect
347367 modernc.org/memory v1.11.0 // indirect
348368 modernc.org/sqlite v1.48.2 // indirect
349- osv.dev/bindings/go v0.0.0-20250808040635-c189436f8791 // indirect
369+ osv.dev/bindings/go v0.0.0-20251029235023-a02c549eeac2 // indirect
350370 sigs.k8s.io/controller-runtime v0.23.3 // indirect
351371 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
352372 sigs.k8s.io/randfill v1.0.0 // indirect
353373 sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
374+ www.velocidex.com/golang/go-ntfs v0.2.0 // indirect
354375 www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect
355376)
356377
0 commit comments